Breaches and incidents
Liberating Research (UK): medical survey firm’s open Elasticsearch server exposed diagnoses of about 100,000 people
UpGuard, which found the exposure, says a publicly accessible Elasticsearch server belonging to the UK medical survey company exposed personal data of...
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- UpGuard, which found the exposure, says a publicly accessible Elasticsearch server belonging to the UK medical survey company exposed personal data of 109,700 unique individuals, 73,944 of them with health information including self-reported diagnoses and medications, plus names, emails, phone numbers, dates of birth and IP addresses.
- Root cause per UpGuard: the server was “misconfigured to allow public access to the data.”
- No attacker named (researcher discovery).
- UpGuard says it discovered and notified the firm on 17 Aug 2026, the server was secured on 18 Aug, and it is “unaware whether Liberating Research ever notified affected persons.”